Turns out 40% of MCP servers have zero authentication, and even the ones that do are broken

A recent study of nearly 8,000 live remote MCP servers revealed that 40.55% lack any authentication, and all servers using OAuth had at least one security flaw. Over 300 CVEs have been filed against MCP infrastructure. The core problem is that MCP servers are acting as identity issuers without being designed for secure operation, raising concerns about their security in production environments.

This report is the first to quantify the widespread authentication failures across nearly 8,000 live MCP servers, revealing that 40.55% have no authentication at all.